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Dear Commissioner Denham, 
CC: Rt Hon Jeremy Wright QC MP, Secretary of State for Digital, Culture, Media and Sport 
Re: The Draft Age Appropriate Design Code for Online Services 


We are writing this letter as a coalition of industry representatives who are committed to protecting 
children and young people online whilst ensuring they continue to have access to the many benefits 
of the digital economy. We are concerned that the Age Appropriate Design Code, as currently 
drafted, will not achieve its stated objectives and risks having an adverse effect not just on the 
diverse organisations providing digital services, but on their users and also the children that this 
code seeks to protect. Given the significant nature of our collective concerns about the draft code 
we believe far more time should be allowed to consult and reconfigure the code so that it can meet 
its objectives without creating such adverse and damaging outcomes 


Having considered the proposals set out in the draft Code carefully we do not believe that they 
achieve the stated ambition to protect children. Instead we believe they will create a new set of risks 
and vulnerabilities. Due to the very onerous requirements to reconfigure services we believe that 
the code would lead to arbitrary age-gating that would restrict children’s ability to benefit from the 
online world while seriously limiting their rights outlined in Article 13 of the UN Convention on the 
Rights of the Child to seek, receive and import information and ideas of all kinds. 


This is as consequence of the Code’s ambitious requirements which are significantly more 
demanding than those under GDPR. The Code appears to go beyond the scope of guidance as 
required under S.123 of the Data Protection Act 2018 and is significant different to previous Codes of 
Practices issued by the ICO. In particular, the requirements go far beyond privacy issues and cross 
over into content decisions, requiring fundamental changes to the way products and services are 
provided for different age groups. Due to this huge burden, it will be simply uneconomic for many 
providers of online services, particularly smaller providers, to tailor their products to different age 
groups. Organisations of all types and sizes, including many not-for-profits, start-ups and SMEs, may 
be forced to simply withdraw their services from young people altogether through the use of age- 
gating. The long-run consequences of the Code for the competitiveness of the UK’s digital industries 
are almost certainly going to be negative, with smaller providers - who are least able to absorb the 
inevitable costs - hit particularly hard by the requirements. 


Although the ICO recognises that age verification and age-gating is not a silver bullet, the code will 
inevitably encourage much greater reliance on it. This would have the perverse outcome of requiring 
significantly more data collection of both adults and children, in direct contradiction to the principle 
of data minimisation. We are concerned that more data collection runs contrary to the spirit of 
GDPR and could create new security vulnerabilities due to the wide range of online services that will 
be required to collect this highly personal and sensitive data. 


The inherent burden and risks involved from these extensive measures would be limited if targeted 
at a small set of companies, using a risk-based approach, and focusing on where harm is evidenced. 
However, the scope of the draft Code casts a far wider net than this, placing requirements on any 
website, app or service ‘likely’ to be accessed by a child. 


‘Likely’ is interpreted very broadly in the draft Code to the point where it perhaps is more accurate 
to define it as ‘able to be accessed by a child’. We do not believe this was Parliament’s intention 
when drafting the relevant legislation (s123 of the Data Protection Act 2018) and would encourage 
the ICO to make the Code truly proportionate and risk-based by focusing on where children are most 
likely to be found and exposed to harm online. Other interpretations of ‘likely’ exist in similar 
regulatory spaces and should be examined; for example from the Competition and Market 
Authority’s Principles for online and app-based games or well-established CAP Code rules for online 
advertising. Using a well-established definition would also be helpful to ensure consistency and 
better understanding and compliance from industry. 


With such a wide range of concerns we urge the ICO to extend the consultation period and ensure 
that the implementation period is sufficient to give all those in scope the time to adapt. The ICO very 
helpfully commissioned research (Towards a Better Digital Future) to explore the views of parents, 
carers and children on a range of issues. We would encourage the ICO to also conduct an economic 
impact assessment and technical feasibility study to better understand the impact on those 
companies and organisations who will have to comply with the Code. 


We all remain committed to creating a safe and secure environment for children to operate online 
and stand ready to provide assistance in amending the Code so that it achieves its objectives while 


maintaining the myriad of benefits that online services give to children. 
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